The Department of Defense began the phased rollout of the Cybersecurity Maturity Model Certification, or CMMC, program today, Nov. 10, marking the end of its voluntary phase, MeriTalk reported Thursday.

The CMMC program is one of the DOD’s key measures to protect sensitive information from cyberattacks and data breaches. Discover other initiatives addressing growing cyber threats and challenges at the Potomac Officers Club’s 2026 Cyber Summit, scheduled for May 21.

What Is the Cybersecurity Maturity Model Certification Rule?

The CMMC rule, formally published in the Federal Register in September, amends the Defense Federal Acquisition Regulation Supplement and introduces mandatory cybersecurity standards for defense contractors. The program was revised in 2021 as CMMC 2.0, reducing complexity and assessment levels.

The DOD’s Office of Small Business Programs launched a pulse survey to gauge contractor readiness and gather input on compliance challenges. Despite industry concerns, particularly from small businesses, CMMC compliance is now mandatory for defense contractors managing sensitive data.

What Are the Three CMMC Certification Levels?

CMMC comprises three certification tiers, each aligned with the sensitivity of government data. Level one requires 15 basic safeguards for federal contract information. Level two mandtes all 110 National Institute of Standards and Technology Special Publication 800-171 controls for protecting controlled unclassified information. Level three adds enhanced NIST SP 800-172 measures to defend against advanced threats.

What Are the Four Phases of DOD’s CMMC Implementation?

The DOD plans to roll out the program in four phases over a three-year period. Phase one (the current phase) requires contractors to complete level one or two self-assessments for eligible solicitations. Phase two will mandate level two certifications, while phase three will focus on level three certifications. Phase four will require all applicable CMMC standards for contract awards. During phases two and three, the department may allow certification delays until an option period.

The Department of Defense has released a “revised” strategy to strengthen U.S. Cyber Command’s workforce and operational readiness, introducing new organizations focused on talent management, advanced training and innovation, Breaking Defense reported Friday. The plan, which appears to be an update of the previous administration’s CYBERCOM 2.0 framework, outlines a new approach to developing and retaining cyber operators across the services.

With the Department of Defense advancing a new strategy to strengthen cyber readiness and workforce capability, conversations around resilience and modernization have never been more urgent. Potomac Officers Club’s 2026 Cyber Summit on May 21 will gather federal and industry leaders to explore the evolving threat landscape, zero trust implementation and the technologies redefining national cybersecurity. Register now to engage with experts shaping the next phase of government cyber defense.

What Changes Does the New Plan Introduce?

The strategy calls for the creation of three key entities: a cyber talent management organization to attract and retain cyber professionals, an advanced cyber training and education center to provide mission-specific instruction, and a cyber innovation warfare center to accelerate the development of operational cyber capabilities.

Katie Sutton, assistant secretary of defense for cyber policy, said the plan “fundamentally changes the Department’s approach to generating cyber forces” by emphasizing “domain mastery, specialized skills, and mission agility.”

The Pentagon said the revised structure is designed to align Cyber Command more closely with the military services, improve coordination in recruitment and training, and address longstanding readiness shortfalls across the cyber mission force.

How Does the Plan Compare to CYBERCOM 2.0?

The new framework retains much of the structure from the CYBERCOM 2.0 initiative introduced in 2023 under then-Commander Gen. Paul Nakasone—a Wash100 Award winner—but expands it to include a revised force management model. The initiative was approved in the final months of the Biden administration and later reworked under the second Trump administration to accelerate implementation.

Former officials stressed that the plan will primarily affect force management, not the way forces are presented or generated.

Elbridge Colby, undersecretary of defense for policy, said the DOD is “laser-focused on strengthening our military’s cyber capabilities to defend the homeland and deter China.”

Why Was a Revision Needed?

Cyber Command’s 147 operational teams have faced persistent readiness issues since their creation, in part due to reliance on the military services to provide trained personnel. Former defense officials and congressional analysts have noted that cyber assignments are often deprioritized when competing with traditional service missions.

The result, according to current and former leaders, has been inconsistent readiness and frequent talent losses to the private sector, where pay and career advancement opportunities are stronger.

Chief Master Sgt. Kenneth Bruce, the command’s senior enlisted leader, said at a June conference that while many components of the original plan will remain, officials are significantly expanding and integrating new elements. Bruce emphasized that the core challenge lies in refining the force generation model, avoiding redundant capabilities and achieving greater integration when addressing cyber challenges, with a focus on how to defeat the “pacing adversary.”

What’s Next for the Cyber Workforce?

The updated plan includes seven guiding principles, including targeted recruitment, incentive programs for retention, agile training and tailored career paths to sustain “cyber mastery.” These measures aim to address structural problems in talent management that have limited Cyber Command’s growth.

While some lawmakers and experts have called for the creation of a separate Cyber Force — a new military branch dedicated to cyberspace operations — others argue that recent congressional authorities have already given Cyber Command near service-like powers, including its own budget control and acquisition authority.